What happened?
cronRegexString in regexes.go is the only full-string validator regex in the file without ^…$ anchors. isCron (baked_in.go) calls cronRegex().MatchString(s), which matches a substring rather than the whole input — so any string that merely contains a cron expression passes validation.
Version
v10.12.0+ including master
Example Code
Examples that currently (and incorrectly) pass `validate:"cron"`:
- "random text @daily more text"
- "x 1 2 3 4 5 y"
- "prefix @every 1h suffix"
- "not at all valid; trailing junk: * * * * *"
What happened?
cronRegexStringinregexes.gois the only full-string validator regex in the file without^…$anchors.isCron(baked_in.go) callscronRegex().MatchString(s), which matches a substring rather than the whole input — so any string that merely contains a cron expression passes validation.Version
v10.12.0+ including master
Example Code